fix: Add Sec-WebSocket-Key and Sec-WebSocket-Version headers when proxying WebSocket from HTTP/2 to HTTP/1 #39375
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Partially fixes #38645
Commit Message:
Implement addition of Sec-WebSocket-Key and Sec-WebSocket-Version headers when Envoy proxies WebSocket requests from HTTP/2 to HTTP/1.
Ensure proper WebSocket upgrade headers are added in compliance with RFC 6455 during HTTP/2 to HTTP/1 proxying.
Note: Sec-WebSocket-Accept header verification is not yet implemented in this PR.
Additional Description:
This PR implements the automatic addition of Sec-WebSocket-Key and Sec-WebSocket-Version request headers when the WebSocket protocol is requested by HTTP/2 client in Envoy and proxied to HTTP/1 backend to comply with RFC 6455 standard.
When the client uses HTTP/2 to make a WebSocket connection with Envoy, Envoy needs to ensure that the WebSocket handshake request contains Sec-WebSocket-Key and Sec-WebSocket-Version request headers when proxied to the HTTP/1 backend. According to RFC 6455, these headers must be included when the client initiates a WebSocket handshake.
Specific implementation:
Sec-WebSocket-Key processing: Envoy will generate a Sec-WebSocket-Key for each WebSocket request and add it to the request header.
Sec-WebSocket-Version processing: Envoy will set Sec-WebSocket-Version to 13, which is the version required by the current WebSocket protocol standard.
Risk Level:
Medium: This functionality involves handling WebSocket headers, which can impact the correctness of WebSocket handshakes. Proper verification and handling are necessary.
Testing:
Manual testing has been conducted in a local environment to verify that Sec-WebSocket-Key and Sec-WebSocket-Version headers are correctly added during the WebSocket handshake from HTTP/2 to HTTP/1.
Automated tests will be added in a follow-up PR to ensure comprehensive coverage and future maintainability.
Docs Changes: None
Release Notes: None
Platform Specific Features: None
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]